Predictable Hash Vulnerability in Booking Calendar Plugin for WordPress
CVE-2026-105193
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 8 October 2026
Badges
What is CVE-2026-105193?
The Booking Calendar plugin for WordPress prior to version 11.8 is susceptible to a vulnerability that compromises the integrity of access hashes. This flaw arises from the generation of hashes that lack sufficient entropy, as they are based on low-entropy time-seeded values. An unauthenticated attacker who can ascertain the creation time of a booking can predict the hash, leading to unauthorized access to personal data associated with that booking or even allowing modifications to the booking itself. It is crucial for users to update the plugin to mitigate these security risks.
Affected Version(s)
Booking Calendar 0 < 11.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.